/**
 * Deterministic-index lookups (`findByDet` / `queryByDet`).
 *
 * A collection that declares `deterministicFields` stamps a deterministic
 * AES-GCM ciphertext for each such field on the envelope's `_det` slot at write
 * time (the encrypt side lives in {@link RecordCodec.encryptRecord}). These
 * helpers are the READ side: recompute the deterministic ciphertext for a query
 * value and scan the adapter for envelopes whose `_det[field]` matches — no
 * record bodies are decrypted during the scan, which is the whole point of a
 * deterministic index.
 *
 * Both functions take a small {@link DeterministicContext} (the exact `this.*`
 * the moving methods touched) instead of `this`, mirroring the `record-keys/`
 * siblings. Behaviour is byte-identical to the inline code they replaced.
 * Elevated records (_tier > 0) are skipped: invisible to tier-0 scans (#691).
 *
 * Internal service — not exported as a `@noy-db/hub/*` subpath.
 */
import { type EnclaveKey } from '../crypto.js';
import type { NoydbStore } from '../../types.js';
import type { RecordCodec } from './record-codec.js';
/** Everything the moving deterministic-index methods touched on `this.*`. */
export interface DeterministicContext<T> {
    /** Collection name — the deterministic-encryption AAD scope. */
    readonly name: string;
    /** Vault namespace the records live under. */
    readonly vault: string;
    /** The ciphertext store (scanned envelope-by-envelope). */
    readonly adapter: NoydbStore;
    /** Declared deterministic-index fields, or null when the feature is off. */
    readonly deterministicFields: ReadonlySet<string> | null;
    /** False on plaintext collections — det lookups are encrypted-only. */
    readonly storeCiphertext: boolean;
    /** The collection DEK resolver. */
    getDEK(): Promise<EnclaveKey>;
    /** The record codec — decrypts a matched envelope to T. */
    readonly codec: RecordCodec<T>;
}
/**
 * Find the first record whose deterministic field matches the given plaintext.
 * Returns `null` when no match exists.
 *
 * Reads every envelope via the adapter and compares the stored `_det[field]` to
 * a freshly computed deterministic ciphertext — no record bodies are decrypted
 * during the search.
 *
 * Throws when the field is not declared in `deterministicFields`, so a typo
 * fails loudly at the call site rather than silently returning null forever.
 */
export declare function findByDet<T>(ctx: DeterministicContext<T>, field: string, value: unknown): Promise<T | null>;
/**
 * Return every record whose deterministic field matches. Same semantics as
 * {@link findByDet} but without the short-circuit.
 */
export declare function queryByDet<T>(ctx: DeterministicContext<T>, field: string, value: unknown): Promise<T[]>;